Answers to Vendor Questions Part 2.docx

1. Is Tier-1 Direct-Bill CSP status a mandatory qualification for award under this solicitation?

Answer: Yes.

2. If so, will the Government consider the effect of that requirement on competition, given that Microsoft Direct-Bill CSP enrollment carries a sustained annual cloud revenue threshold and an approved support plan that most small businesses eligible for this Total Small Business set-aside will not hold?

Answer: No. This requirement is non-negotiable.

3. Will the Government accept an Indirect CSP (Tier-2) relationship through an authorized Microsoft distributor, or a design-and-configure approach performed entirely within a Government-owned Azure subscription, as satisfying the intent of this requirement?

Answer: No.

4. Does CLIN 0001 require the Contractor to procure, resell, and bill Azure consumption on behalf of the Government, or does it require the contractor to configure, monitor, and report consumption within a Government-owned and Government-billed Azure subscription?

Answer: Contractor is expected to invoice based on actual consumption each month. NTE $4k per month. Invoices that exceed the actually Azure consumption bill will be rejected. License fees will also be billed against this CLIN.

5. Is ongoing managed security service in scope of CLIN 0002, or is CLIN 0002 limited to the four implementation tasks in PWS 5.2?

Answer: No ongoing managed security services. CLIN 0002 is limited to the tasks in PWS 5.2

6. If managed service is in scope, will the Government issue a definition of the service period, staffing coverage hours, and measurable standards, since the PRS contains no objective against which such performance could be surveilled?

Answer: Managed services is not in-scope for this contract. The PWS has been updated to reflect that.

7. The Product Specifications direct the vendor to provide and configure an Exchange Online Plan 1 license for email alerting and to provide Defender for Cloud for storage protection. Are these items contractor-furnished or Government-furnished?

Answer: Customer has MS 365 A5 which includes all advanced licensing feature for Defender, Entra, and Intune. No additional licensing from the contractor is expected. If additional licensing is required to execute elements of the PWS, contractor will notify the government who will procure licensing through their current MS support partner.

8. PWS 5.2.2.2 and PWS Attachment 1 require design to OMB M-21-31 Event Logging Tier 2 for endpoint logs. Amendment 0001 states that the retention standard should follow the Optimal Tier under M-26-14, which recently replaced M-21-31, and specifies 6 months searchable retention and 12 months archived retention.

· Which memorandum and which tier govern the design baseline the contractor is to be held to?

M-26-14 and Level 3 (excluding Data Retention standards which will be retained according to M-26-14 Level 4 (6 months searchable and 12 months retrievable).

· Do the 6-month and 12-month retention durations in Amendment 0001 supersede the EL2 retention expectation in PWS 5.2.2.2, or are they planning parameters for CLIN 0001 pricing only?

Amendment 1 retention periods supersede EL2 retention expectations.

· For the Lead Sentinel Architect qualification in Attachment 1, will the Government accept demonstrated experience against M-26-14 or another equivalent federal logging maturity requirement in place of M-21-31 EL2 specifically?

· Yes

9. Could you confirm whether an offeror may use named teammates or subcontractors to satisfy the Microsoft Solution Partner, Tier-1 CSP and key-personnel requirements? Also, are all expected on-site and remote performance needs contained in the current solicitation package?

Answer: Subcontracting of CSP is not authorized. Offeror must be a Microsoft Solution Provider.

10. Clarification request regarding Key Personnel: The solicitation requires that 'The Contractor shall propose a single individual to fill each Key Personnel role.' For a Total Small Business set-aside, please confirm whether the Lead Sentinel Architect and Contract Manager may be proposed as subcontracted personnel (i.e., via a teammate or 1099 arrangement), or whether both Key Personnel must be W-2 employees of the prime quoter. If subcontracting is permitted, please confirm any applicable limitations (e.g., percent of effort or affiliate rules) consistent with the SBA's size standard for the relevant NAICS code.

Answer: For a services contract, the prime small business must perform at least 50% of the cost of the contract incurred for personnel with its own employees or employees of a similarly situated entity (another certified small business under the same NAICS).

11. The Past Performance factor requires 'three current/relevant examples within past three years' of 'similar services,' and notes that 'quoters with no prior government contracts may submit similar work for State/local governments, private industry, educational institutions, or past Government service.' Please clarify what scope of work the Government considers 'similar' for evaluation purposes. Specifically, would engagements involving (a) Microsoft 365 security configuration, (b) cloud SIEM/SOAR integration, or (c) custom software development and integration supporting federal cybersecurity or compliance outcomes qualify as 'similar services' even if Microsoft Sentinel was not the specific platform used?

Answer:

"Similar services" are evaluated against the core scope of the PWS (cloud SIEM/SOAR deployment, M365 security integration, and federal logging compliance):

(a) M365 Security Configuration: Similar. Enterprise configuration of Defender, Entra ID, Intune, and M365 logging is directly relevant (PWS 5.2.1.3, 5.2.3.2).

(b) Cloud SIEM/SOAR Integration: Similar. Enterprise cloud SIEM/SOAR implementations qualify, even if Sentinel was not the specific platform used (Attachment 1).

(c) Custom Software Development: Not Similar. Standalone software development does not qualify unless directly centered on SIEM/SOAR engineering, log ingestion pipelines, or security automation workflows.

Quoters must clearly demonstrate how past projects align with these technical areas. The Government will determine relevance based on overall scope and complexity.

12. Please clarify the scope and assumptions for the discovery and assessment phase. Specifically: (a) Is the contractor expected to perform tenant readiness assessment at no additional cost, or will changes to scope driven by pre-existing tenant conditions (e.g., partial Sentinel deployment, A5 licensing gaps, missing connectors) be addressed via contract modification? (b) Does the Government have an estimated level of effort or hours assumed for discovery? The 98% ingestion target appears to assume an undefined starting baseline, which materially affects price and team composition.

A) Gaps in tenant conditions can be discussed for contract modification, however no current sentinel deployment exists. The starting baseline is a MS365 environment with the appropriate A5 licensing. Sentinel has not been established, nor do any current connectors exist. B) Tenant readiness assessment should not exceed 14 calendar days.

13. The requirements reference work performed on a DoD Impact Level 2 (IL2) information system and cite DoDM 8140/DoD 8570.01-M baselines. Please confirm: (a) Whether contractor personnel performing on this effort will require routine access to IL2 systems and therefore must hold a CAC or similar DoD-issued credential; (b) Whether any facility clearance (FCL), cleared workspace, or secure-room access is required for performance; and (c) Whether the Government will sponsor contractor personnel for IT-II/IT-III positions, or whether quoters are expected to bear sponsorship and investigation costs.

ANSWER: (a) No special credentials. (b) No. All work will be completed remotely. (c) No. Not applicable.

14. For a Total Small Business set-aside, please confirm the extent to which the prime quoter may rely on subcontracted Key Personnel and other teammates without jeopardizing size status. Specifically: (a) Is FAR Clause 52.219-14 (Limitations on Subcontracting) or the SBA '50% Rule' invoked, and does the prime quoter need to perform at least 50% of the cost of contract performance? (b) Are there any restrictions on the dollar value or scope of effort that may be subcontracted to other-than-small or similarly situated concerns?

You may propose subcontracted personnel for the Lead Sentinel Architect and Contract Manager roles. However, you must ensure that your company (the prime) still performs at least 50% of the personnel costs for the entire contract with your own employees to remain compliant with the small business set-aside regulations.

When submitting your proposal, it is critical that the resumes for these key individuals clearly demonstrate that they meet or exceed all qualifications listed in Attachment 1 of the PWS.

15. The requirements state the contractor must 'design a system that complies with NIST SP 800-53 and OMB M-21-31 event logging mandates.' Please confirm the OMB M-21-31 maturity tier required for this effort (e.g., EL2 'Intermediate Logging' versus EL3 'Advanced Logging'), and whether the Government intends for the contractor to deliver EL2-level capability or to mature the environment to a higher tier over the one-year PoP. This materially affects scope, analytics rule development, log retention configuration, and pricing.

M-26-14 and Advanced (Level 3) (excluding Data Retention standards which will be retained according to M-26-14 Level 4 (6 months searchable and 12 months retrievable).

16. CSP REQUIREMENT (CLIN 0001). The Product Specifications require the contractor to be a Microsoft Solution Partner and a Tier-1 (Direct-Bill) Cloud Solution Provider. PWS 1.2 states no additional licensing from the contractor is expected, and any licensing that is required would be procured by the Government through its current Microsoft support partner. Are these designations mandatory for award? If they are, can CLIN 0001 be met through a CSP Indirect Reseller arrangement? Can the Government instead procure the Azure consumption under its existing Microsoft agreement, with the contractor providing implementation and support only? If the requirement stands, will the Government consider removing it? Very few small businesses hold Tier-1 Direct-Bill status, and the requirement appears to conflict with PWS 1.2.

Answered in previous questions.

17. SLO COVERAGE HOURS. The Product Specifications set incident response and resolution times but no coverage window. PWS 1.5.4 states contractor support hours may differ from Government facility hours but does not define them. PWS 1.11 ties Key Personnel availability to the PWS 1.5.4 hours of 0800 to 1700 Eastern, Monday through Friday. Do the SLOs apply during those hours or on a 24x7 basis?

Answer: 24x7 support is not required on this contract.

18. Can the Government provide additional information regarding the current Microsoft 365 A5 and Azure environment, including Microsoft Defender products, Microsoft Entra ID, Microsoft Intune, and other security services currently deployed and configured?

Answer:

Round 1, Q&A provided the tenant type (Commercial – Education licensing), Azure region (MS365 Tenant – USA -> East), daily ingestion assumptions (Analytics Tier: 24 GB/day, Data Lake Tier: 55 GB/day), and confirmed that the customer has active MS 365 A5 coverage encompassing Entra, Intune, and Microsoft Defender suite features

19. The requirement identifies approximately 350 endpoints for Microsoft Sentinel onboarding. Can the Government provide the approximate distribution of Windows workstations, Windows/Linux servers, virtual machines, mobile devices, network/security appliances, and other endpoint types included in this population?

Approximately 325 Endpoints and 13 Windows Servers (4 Physical/9 VM).

20. In addition to Microsoft 365, Entra ID, Intune, and Microsoft Defender, what additional data sources, applications, infrastructure, network devices, or security products does the Government expect to ingest into Microsoft Sentinel?

The endpoints are the focus with secondary focus on ingest of Cisco networking products, Aruba Wireless architecture

21. Can the Government provide the estimated current or anticipated daily log-ingestion volume and required Sentinel data-retention period so industry can accurately plan the architecture, capacity, and associated Microsoft consumption requirements?

Answered in previous round of questions.

22. Does USAWC have an existing set of security use cases, threat scenarios, detection requirements, or analytics rules that the contractor will be expected to migrate or implement, or should the contractor develop the initial detection catalog as part of the engagement?

Answer:

In Round 1, Question 5, the Government explicitly stated: "The offeror should assume to be green fielding this solution, there is no requirement for dashboard, detections, or logs migration.

23. What security-response processes does the Government expect to automate through Microsoft Sentinel playbooks, and will the contractor be permitted to integrate Logic Apps or other Microsoft services with existing incident-response, notification, ticketing, or workflow systems?

In accordance with PWS 5.2.2.4 and 5.2.3.4, the Contractor is expected to design and deploy automated playbooks using Azure Logic Apps for incident triage, escalation, notification, and containment aligned to the core threat scenarios outlined in PWS 5.2.2.3.

· ITSM / Workflow Systems: The Government does not intend to integrate Logic Apps with external third-party ticketing or ITSM platforms (e.g., ServiceNow, Jira, Remedy). All notifications, workflow escalations, and automated response actions shall remain within the native Microsoft 365 / Azure ecosystem (e.g., Microsoft Sentinel, Entra ID, Defender XDR, Intune, Teams, and Exchange/Email).

· Data Ingestion & Monitoring: Ingesting telemetry from monitored infrastructure (including endpoints and network devices) into Microsoft Sentinel via native Microsoft connectors or standard Azure data collection agents is within the SIEM logging architecture outlined in PWS 5.2.1 and 5.2.2.

Specific playbook designs and automations will be finalized during Task 2 and approved via Deliverable T.008 (Automation, IR, & Dashboard Specifications)

24. In addition to the NIST SP 800-53 and OMB M-21-31 requirements identified in the acquisition documentation, are there Army, DoD, USAWC, RMF, DISA STIG, Zero Trust, or other cybersecurity requirements that should specifically govern the Sentinel architecture and implementation?

The specific DoD, Army, and federal cybersecurity mandates governing the Microsoft Sentinel architecture and implementation are already established in the solicitation:

· Applicable Publications: In accordance with PWS Part 6, the effort is governed by NIST SP 800-53, DoDI 8500.01, DoDI 8510.01 (RMF), AR 25-2 (Army Cybersecurity), and DoDM 8570.01-M.

· Logging Baseline: In accordance with Round 1 Q&A, event logging and retention must align with the Optimal Tier under OMB M-26-14 (which supersedes M-21-31).

· Architecture Principles: Per PWS 5.1.1, the implementation must strictly incorporate Zero Trust principles .

No additional local technical mandates beyond those identified in PWS Part 6 and PWS Section 5 are required for this deployment.

25. What level of tenant access, administrative privileges, Government-furnished accounts, licenses, documentation, architecture information, and technical personnel will be available to the contractor during discovery, implementation, testing, and knowledge transfer?

Answer: PWS Part 3 (Sections 3.4 & 3.5) & Round 1 Q2: Logical access and documentation provided by the Government

26. What technical and operational criteria will USAWC use to determine that Microsoft Sentinel has been successfully implemented and is considered fully operational—for example, required data connectors, endpoint coverage, analytics-rule validation, incident generation, automation-playbook testing, dashboards/workbooks, documentation, and administrator acceptance?

Answer: PWS Technical Exhibit A (PRS #3): 98% data ingestion, 100% analytics/playbook validation via Operational Readiness Review (ORR) .

27. How many USAWC administrators or cybersecurity personnel are expected to participate in knowledge-transfer and administrator training, and does the Government prefer instructor-led training, hands-on technical workshops, recorded materials, written runbooks, or a combination of these approaches?

Vendor should be prepared to train up to 15 administrators and cybersecurity personnel. A combination of approaches works best as different individuals learn in different ways.